The use of digital data is essential for the SUBARU Group in the course of its business activities. The use of digital data is not limited to traditional information systems but covers diverse realms, including facilities, products, and a whole range of services offered by the Group. Being aware of our social responsibility to handle digital data in these realms safely, SUBARU has established the Basic Cybersecurity Policy, undertaking cybersecurity activities Group-wide.

To enhance the effectiveness of the SUBARU Group’s response to security risks, SUBARU established the position of Chief Information Security Officer (CISO) in FYE March 2026. Accordingly, we have established a Cybersecurity Committee, chaired by the CISO, to serve as the decision-making body overseeing Group-wide cybersecurity strategy.
Upper management also participate as members of the committee, which is responsible for formulating various policies and monitoring the progress of initiatives reported at Cybersecurity Meeting. The Chief Information Officer (CIO), who oversees IT strategy and infrastructure development, also serves as a member of the committee. The results of the committee’s deliberations are reported by the CIO at joint meetings attended by all executive officers, and are also reported to the Board of Directors as necessary.
Under the guidance and supervision of the committee, cybersecurity departments—which are responsible for day-to-day operations—take the lead in establishing and operating a security management system for information technology, networks, systems, and products, and in promoting various security measures.
In addition, SUBARU has established the SUBARU Security Incident Response Team (SBR-SIRT) as a specialized organization to respond to security incidents. In times of normalcy, the SBR-SIRT monitors threats to the SUBARU Group’s protected areas, and in the event of an emergency, carries out activities to quickly and appropriately protect and restore those assets. In addition, the SBR-SIRT has established comprehensive response procedures covering incident detection, reporting, recovery, and prevention of recurrence; it promptly reports serious incidents to management and coordinates with external agencies.

Cybersecurity Promotion System

The SUBARU Group makes extensive use of information technology, networks, and various information systems in its business activities, such as product development, production, and sales. In addition, its products are equipped with electronic components and are controlled by software.
In recent years, cyberattacks have become increasingly sophisticated and intricate, and risks such as targeted attacks, ransomware, unauthorized access, and attacks via the supply chain continue to grow. Furthermore, while the SUBARU Group is increasingly utilizing cutting-edge technologies, such as generative AI, to improve operational efficiency and create added value, there are growing concerns about the emergence of new risks, such as the unintended leakage of information, the improper handling of confidential and personal information, errors in judgment and quality deterioration resulting from the use of incorrect output, infringement of third-party intellectual property rights, and violations of laws, regulations, and contracts. There is also a growing risk of cyberattacks, such as sophisticated phishing scams, identity theft, and unauthorized access, that exploit generative AI.
In addition, a potential malware infection, leak of personal or confidential information due to human error or fraudulent activity, system failure, or large-scale power outage, fire, or natural disaster, presents the risk not only of the suspension of key operations and services, data corruption or loss, and adverse effects on the quality and safety of products and services, but also of a decline in social trust and brand value. As a result, this could have a significant impact on the SUBARU Group’s business activities, business performance, and financial condition. To appropriately address these risks, we are implementing various measures under our Basic Cybersecurity Policy.

Product Cybersecurity

SUBARU has established a cybersecurity management system in accordance with UNR155^*1, the United Nations regulation on automotive cybersecurity, and continuously assesses, addresses, and monitors cybersecurity risks in its vehicles. In addition, SUBARU is a member of Auto-ISAC^*2 in both Japan and the United States, and utilizes the shared information on automotive cybersecurity to enhance vehicle security.

*1

UNR155 (United Nations Regulation No. 155): A regulation on automotive cybersecurity established by the United Nations Economic Commission for Europe’s World Forum for Harmonization of Vehicle Regulations (UNECE WP.29)

*2

Auto-ISAC (Automotive Information Sharing and Analysis Center): An organization that shares and analyzes information on cybersecurity in the automotive industry to enhance the industry’s overall response capabilities

Conducting Internal Audits and Third-Party Assessments and Enhancing Supply Chain Security

SUBARU continuously conducts internal audits as part of its regular operations in accordance with its Group-wide Cybersecurity Rules.
We are also working to strengthen collaboration with our consolidated subsidiaries outside Japan; in addition to regularly sharing information, we are implementing improvement measures based on the results of assessments conducted in accordance with these regulations.
In addition, we regularly undergo third-party evaluations conducted by external specialized agencies.
To strengthen supply chain security, we conduct annual surveys of our business partners to assess their security measures and provide recommendations for improvement as needed.

Cybersecurity Education

To address a wide range of cybersecurity risks, SUBARU regularly conducts role-specific education and targeted email attack drills. Targeted email attack drills are to be conducted at least once a year, and were conducted twice in FYE March 2026. We also conducted recovery drills using actual equipment (IT-BCP drills) to simulate an incident scenario.

Number of Participants in Each Education Program and Drill

(Employees)